🔤
Homoglyph Attacks (Lookalike Domains)
High SeverityHomoglyph domains increased 400% between 2021-2023
Homoglyph attacks exploit characters that look visually identical or very similar across different alphabets. Attackers register domains like "pаypal.com" (Cyrillic "а") that appear identical to "paypal.com" (Latin "a").
How it works
- Attacker identifies target brand domain (e.g., paypal.com)
- Registers a domain substituting look-alike Unicode characters
- Common swaps: Cyrillic а/о/е for Latin a/o/e, digit 1 for lowercase l
- Sends emails from the visually-identical domain that pass basic checks
Red flags to watch for
- Email from a "known" sender but something feels off
- Copy-paste the domain and compare it — homoglyphs break when pasted into a text editor
- Unexpected requests from normally trusted senders
Real-world example
Subject: Your PayPal receipt for $499.99
From: service@pаypal.com
“You sent a payment of $499.99 to Electronics Depot. If you didn't authorize this transaction, click here to dispute it immediately.”
How to protect yourself
- Use SiftMail Business tier with homoglyph detection enabled
- Be suspicious of any email requesting action, even from "known" senders
- Copy-paste sender addresses into a plain text editor to reveal character substitutions
How SiftMail detects this
SiftMail Business tier includes dedicated homoglyph detection that identifies Unicode character substitutions, Levenshtein-distance domain similarity, and flags impersonation attempts automatically.
Stop homoglyph attacks (lookalike domains) before they reach your inbox
SiftMail scores every incoming email and automatically quarantines threats. Free plan available, setup takes 30 seconds.